I read some parts of the spec of WebAssembly recently, and there were several things that disappointed me. To name a few:
1) There is no way to allocate in a function's variable stack continuous memory space that spans more than 8 bytes. This implies that if a function has as a local variable compound data structure such as an array or a struct, you have to a) have a global virtual stack pointer, b) manipulate the stack pointer to allocate space for the data structure in the virtual stack on the memory, c) read from or write to the allocated memory space, and finally d) restore the stack pointer before the function exits. This is exactly like what resulting assembly code of C compiler does. Why do we have function locals as a WASM primitive, then, if we have to end up with manipulating the stack pointer?
2) Currently a function can only return one value even though it is trivial to add support to mutiple return values taking advantage of the fact that WASM is stack-based. And what puzzles me is that mutiple return values is actually mentioned as a possible feature in the future, in several places in the spec. WASM reached the MVP before adding it, which means that we will have to stick with one-return-value functions for quite a long time even if it is added in the future.
From my experiences of reversing Windows x86 applications, I don't think WebAssembly has a greater capacity for obfuscation. In fact, I think WebAssembly is less capable of obfuscating code than JavaScript.
It is because WASM does not allow self-modifying code, which is a highly effective obfuscation technique as it can hinder static analysis. On the other hand, JavaScript has eval among other things that can be used to dynamically craft and execute code during execution. I've never seen such JavaScript but it would be quite cumbersome to trace code within a call to eval within a call to eval, and so on. You might need to build a custom V8 to record strings passed to eval when reversing such code.
According to the paper, they seem to have modified Chromium's JavaScript engine in order to record execution paths of JavaScript code. Does anyone know exactly how they modified Chromium (or preferably the exact patch they applied to Chromium)?
1) There is no way to allocate in a function's variable stack continuous memory space that spans more than 8 bytes. This implies that if a function has as a local variable compound data structure such as an array or a struct, you have to a) have a global virtual stack pointer, b) manipulate the stack pointer to allocate space for the data structure in the virtual stack on the memory, c) read from or write to the allocated memory space, and finally d) restore the stack pointer before the function exits. This is exactly like what resulting assembly code of C compiler does. Why do we have function locals as a WASM primitive, then, if we have to end up with manipulating the stack pointer?
2) Currently a function can only return one value even though it is trivial to add support to mutiple return values taking advantage of the fact that WASM is stack-based. And what puzzles me is that mutiple return values is actually mentioned as a possible feature in the future, in several places in the spec. WASM reached the MVP before adding it, which means that we will have to stick with one-return-value functions for quite a long time even if it is added in the future.